petropy

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, which represents a theoretical surface for indirect prompt injection if malicious instructions were embedded in logs or configurations.
  • Ingestion points: Ingests data from LAS (Log ASCII Standard) files and JSON configuration files in scripts/formation_evaluation.py.
  • Boundary markers: No explicit delimiter-based safety prompts are used to isolate data from instructions.
  • Capability inventory: The skill's capabilities are limited to file system read/write operations for data logs and plots. It does not possess network exfiltration, subprocess execution, or dynamic code evaluation capabilities.
  • Sanitization: Uses standard scientific parsing libraries (lasio, petropy, and json) which treat inputs as data structures rather than executable code.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes several standard, open-source scientific Python packages for its calculations and data handling.
  • Evidence: Dependencies identified in SKILL.md include petropy, lasio, and numpy. Code references also suggest usage of matplotlib and pandas for visualization and data exporting.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:44 PM
Security Audit — agent-trust-hub — petropy